The framework · Index

The Essential Eight, control by control

The Essential Eight — often written Essential 8 — is the Australian Signals Directorate's baseline of eight mitigation strategies, each assessed at maturity Levels 0–3. These plain-English explainers cover what each control means for a small business, what the levels require, and why brokers and insurers keep asking about them.

01 / 08

Application control

Application control means your computers only run software the business has approved. Instead of trying to spot every piece of malware, it flips the model: nothing runs unless it is on the allowed list. It is one of the most effective defences against ransomware and malicious downloads.

Read the explainer

02 / 08

Patch applications

Patching applications means updating everyday software — browsers, office suites, email clients, PDF readers, antivirus — promptly when vendors release security fixes. Attackers routinely exploit known flaws in out-of-date software, often within days of a fix being published.

Read the explainer

03 / 08

Restrict Microsoft Office macros

Microsoft Office macros are small programs embedded in documents and spreadsheets. They are also a favourite delivery mechanism for malware — a booby-trapped invoice or résumé that runs code the moment someone clicks "enable". This control restricts which macros can run, especially in files from the internet.

Read the explainer

04 / 08

User application hardening

User application hardening means switching off the risky features of everyday software that attackers abuse — browsers running Java or ads from the internet, Office spawning other programs, legacy tools like Internet Explorer 11. Most businesses never need these features, so turning them off costs little and removes real attack paths.

Read the explainer

05 / 08

Restrict administrative privileges

Administrative (admin) accounts can install software and change security settings — which makes them the first thing attackers hunt for. This control keeps admin rights to the few people who need them, separates admin accounts from everyday accounts, and keeps privileged access reviewed and logged.

Read the explainer

06 / 08

Patch operating systems

Patching operating systems means keeping Windows, macOS, and the firmware on servers, firewalls and routers up to date with security fixes — and replacing systems so old they no longer receive updates. Internet-facing devices matter most, because attackers can probe them directly.

Read the explainer

07 / 08

Multi-factor authentication

Multi-factor authentication (MFA) requires a second step to sign in — a code from an app, a security key, a fingerprint — so a stolen password alone is not enough. It is the single control insurers ask about most, because it stops the most common attack there is: someone signing in with credentials phished from your staff.

Read the explainer

08 / 08

Regular backups

Regular backups protect the data your business runs on — and, crucially, they must be protected from tampering and actually tested. A backup that ransomware can encrypt, or that has never been restored in practice, gives false comfort. This control covers backup cadence, protection, and tested restoration.

Read the explainer

Check your maturity across all eight — free